| go-git missing validation decoding Index v4 files leads to panicCVE-2026-33762 · GHSA-GM2X-2G9H-CCM8Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Low
|
Fix reported |
|
| Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client CertificatesCVE-2025-37731 · GHSA-M9GH-789G-Q5PV |
org.elasticsearch.plugin:x-pack-coreorg.elasticsearch.plugin:x-pack-security |
MavenRed Hat |
Medium
|
Fix reported |
|
| containerd CRI checkpoint restore CDI annotation smugglingCVE-2026-53492 · GHSA-33VJ-92QQ-66HCVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
High
|
Fix reported |
|
| Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41568 · GHSA-VP62-88P7-QQF5Version ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git improperly verifies data integrity values for .idx and .pack filesCVE-2026-25934 · GHSA-37CX-329C-33X3Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URLCVE-2026-24117 · GHSA-4C4X-JM2X-PF9JVersion ranges need review. |
github.com/sigstore/rekorAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Rack has a Possible Information Disclosure VulnerabilityCVE-2025-61780 · GHSA-R657-RXJC-J557 |
OpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8OpenShift Service Mesh 2/openshift-service-mesh/istio-cni-rhel8 |
Red HatRubyGems |
Medium
|
Fix reported |
|
| Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parametersCVE-2025-59830 · GHSA-625H-95R8-8XPM |
OpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8OpenShift Service Mesh 2/openshift-service-mesh/istio-cni-rhel8 |
Red HatRubyGems |
High
|
Fix reported |
|
| go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustionCVE-2026-44740 · GHSA-M3XC-H892-GGX6Version ranges need review. |
github.com/go-git/go-billy/v5github.com/go-git/go-billy/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| Docker: Race condition in docker cp allows bind mount redirection to host pathCVE-2026-42306 · GHSA-RG2X-37C3-W2RHVersion ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
High
|
Fix reported |
|
| go-git: Credential leak via cross-host redirect in smart HTTP transportCVE-2026-41506 · GHSA-3XC5-WRHM-F963Version ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Maliciously crafted idx file can cause asymmetric memory consumptionCVE-2026-34165 · GHSA-JHF3-XXHW-2WPPVersion ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockCVE-2026-22701 · GHSA-QMGC-5H2G-MVRWVersion ranges need review. |
filelockMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP Vulnerable to Cookie Parser Warning StormCVE-2025-69230 · GHSA-FH55-R93G-J68GVersion ranges need review. |
aiohttpMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP vulnerable to DoS through chunked messagesCVE-2025-69229 · GHSA-G84X-MCQJ-X9QQVersion ranges need review. |
aiohttpMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP vulnerable to DoS when bypassing assertsCVE-2025-69227 · GHSA-JJ3X-WXRX-4X23Version ranges need review. |
aiohttpOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP has unicode match groups in regexes for ASCII protocol elementsCVE-2025-69225 · GHSA-MQQC-3GQH-H2X8Version ranges need review. |
aiohttpMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| sigstore legacy TUF client allows for arbitrary file writes with target cache path traversalCVE-2026-24137 · GHSA-FCV2-XGW5-PQXFVersion ranges need review. |
github.com/sigstore/sigstoreAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
